PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Recon Series #1: Discovering and mapping hidden endpoints and parameters to expand attack surfaces

yeswehack.com | blog | #bug-bounty | #fuzzing | #javascript | #recon | #ffuf | #linkfinder
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Recon series #1 on discovering hidden endpoints and parameters: JavaScript analysis with LinkFinder, fuzzing with ffuf and Burp Intruder, wordlist strategy and header fuzzing techniques.
Published
Collected

Related coverage

blog · projectzero.google
Announcing the Fuzzilli Research Grant Program
Project Zero’s mission is to make 0-day hard in order to improve end-user security. We attack this problem in different ways, including supporting other security researchers. While Google currently offers research grants, they are limited to academics and those affiliated with universities.
blog · yeswehack.com
‘People think I’m all about automation, but I only automate recon’: how rabhi became our all-time #1 Bug Bounty hunter
YesWeHack interviews Issam Rabhi, its all-time #1 bug bounty hunter, on his path from reverse engineering to top rankings, his recon-first automation methodology, favourite vulnerability types, notable finds, and advice for aspiring hackers.
blog · yeswehack.com
Recon Series #6: Excavating hidden artifacts with Wayback Machine and other web-archive tools
Recon series #6 explains archive-based reconnaissance with Wayback Machine, CommonCrawl, Archive.today and URLScan to recover deprecated endpoints, embedded secrets and forgotten admin panels.
blog · yeswehack.com
Recon series #5: A hacker’s guide to Google dorking
Beginner-friendly guide to Google dorking: core operators such as site:, inurl: and filetype:, plus hands-on queries for subdomain discovery, hidden files, login portals and exposed credentials.
blog · yeswehack.com
Recon series #4: Port scanning – uncovering attack vectors by revealing open ports and hidden services
Recon series #4 on port scanning: passive scans via Shodan and Censys, active TCP/UDP techniques, banner grabbing, firewall evasion, and tools including Nmap, Masscan, Naabu and httpx.
blog · yeswehack.com
Recon series #3: HTTP fingerprinting – sleuthing for a web application’s hidden vulnerabilities
Recon series #3 on HTTP fingerprinting: analysing response headers, banner grabbing, malformed requests, default file structures and cookie parameters to map technologies and hidden weaknesses.
Back